DeepLeak: Privacy Enhancing Hardening of Model Explanations Against Membership Leakage

TL;DR

DeepLeak tackles privacy risks in ML explainability by auditing membership leakage from post-hoc explanations and providing lightweight defenses. It introduces a two-stage approach: leakage profiling with a strengthened explanation-aware MIA and practical hardening strategies that are model-agnostic. The work benchmarks 15 explanation methods across four families on image datasets, showing substantial leakage under default settings and significant leakage reductions (up to 95%) with minimal utility loss. It provides a reproducible path to safer explainability in privacy-sensitive ML with open-source code.

Abstract

Machine learning (ML) explainability is central to algorithmic transparency in high-stakes settings such as predictive diagnostics and loan approval. However, these same domains require rigorous privacy guaranties, creating tension between interpretability and privacy. Although prior work has shown that explanation methods can leak membership information, practitioners still lack systematic guidance on selecting or deploying explanation techniques that balance transparency with privacy. We present DeepLeak, a system to audit and mitigate privacy risks in post-hoc explanation methods. DeepLeak advances the state-of-the-art in three ways: (1) comprehensive leakage profiling: we develop a stronger explanation-aware membership inference attack (MIA) to quantify how much representative explanation methods leak membership information under default configurations; (2) lightweight hardening strategies: we introduce practical, model-agnostic mitigations, including sensitivity-calibrated noise, attribution clipping, and masking, that substantially reduce membership leakage while preserving explanation utility; and (3) root-cause analysis: through controlled experiments, we pinpoint algorithmic properties (e.g., attribution sparsity and sensitivity) that drive leakage. Evaluating 15 explanation techniques across four families on image benchmarks, DeepLeak shows that default settings can leak up to 74.9% more membership information than previously reported. Our mitigations cut leakage by up to 95% (minimum 46.5%) with only <=3.3% utility loss on average. DeepLeak offers a systematic, reproducible path to safer explainability in privacy-sensitive ML.

Figures (6)

• Figure 1: DeepLeak system overview.
• Figure 2: DeepLeak hardening optimization Pareto fronts for Saliency Map, Integrated Gradients, and SHAP.
• Figure 3: DeepLeak hardening optimization Pareto fronts for Occlusion, GradCam++, LIME, and ProtoDash.
• Figure 4: Runtime overhead ($ks$) of hardening strategies across explanation methods and datasets.
• Figure 5: Runtime overhead ($ks$) of hardening strategies across representative explanation methods and different model architectures.